Free ISO-IEC-27001-LEAD-AUDITOR Web TestEngine Demo

Q9 Multiple choice

You are an experienced audit team leader conducting a third-party surveillance audit of an organisation that designs websites for its clients. You are currently reviewing the organisation's Statement of Applicability.

Based on the requirements of ISO/IEC 27001, which two of the following observations about the Statement of Applicability are true?

Select all that apply.

A
Justification for both the inclusion and exclusion of Annex A controls in the Statement of Applicability is required
B
The Statement of Applicability is owned and amended by the organisation's top management
C
The Statement of Applicability must be reviewed at least annually
D
A Statement of Applicability must be produced by organisations seeking ISO/IEC 27001 conformity
E
Justification is only required for any controls that the organisations choses to exclude
F
The Statement of Applicability must be reviewed at Management Review

ISO-IEC-27001-LEAD-AUDITOR Web TestEngine demo